Privacy Policy

Digital XP (“we”, “us”) is the data controller responsible for the personal data described in this policy. We are based in the United Kingdom, and this policy is written to meet the UK GDPR and the Data Protection Act 2018.

• Email: info@digitalxp.co.uk

When you submit a quote request. The quote form asks for your name, email address, company name, and optionally your phone number. It also records the details you give us about the work: the services you're interested in, your description of the project, your budget range and timeline, your stated priorities, whether you hold quotes from other suppliers (and their price and scope, if you choose to share them), and how you heard about us.

When you email us. We receive whatever you put in the message, along with your email address.

When we research potential business clients. We use Companies House records and information published on a business's own website to check its registration and identify relevant services. We may also use publicly available business job adverts, business profiles and company announcements to understand its work and assess a possible need for our services. We record its company name and number, website, published business email address, the source of those details and relevant observations about its business. We also record our correspondence and any request not to receive further marketing. Our internal AI assistant helps research businesses and prepare messages; relevant business information may be processed by OpenAI for these tasks.

When you sign an agreement with us. If we send you a contract to sign online, the signing page records your registered company name and number, your registered address, the name and position of the person signing, and an image of the signature they draw on screen. To confirm it is really you, we email a one-time code to the address the link was sent to, and we record when it was entered, the IP address it came from, and the browser used. That record is printed as an audit page on the signed PDF, because the point of it is to be shown — to you, and to anyone who ever needs to establish that the agreement was signed by whom it says.

When we manage your project and support requests. Our internal CRM holds business contacts, proposals, invoices, payment records, project tasks, support conversations and attachments. Our founders use an internal AI assistant to help with this work. Relevant excerpts of these records may be processed by OpenAI to answer requests and prepare drafts. New prices, contractual changes and publication of code require founder approval.

Connected company accounts. With the company account holder's authorisation, our CRM connects to Digital XP's Gmail and Google Calendar to synchronise correspondence and events, check availability, and send approved business messages and invitations. These connections are for our company accounts; clients do not need to grant access to their personal Google accounts. The account holder can disconnect Google in CRM Settings or revoke access in their Google Account. Disconnecting stops future access; existing business records remain subject to the retention and deletion arrangements below.

Automatically. Our hosting provider records standard server logs, which include your IP address, browser user-agent, and the pages requested. These are used for security and reliability, not to build a profile of you.

• To respond to your enquiry and prepare a quote. Lawful basis: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)).
• To deliver work you engage us for, including follow-up correspondence. Lawful basis: performance of a contract (Article 6(1)(b)).
• To keep the site secure and available. Lawful basis: our legitimate interests in preventing abuse and diagnosing faults (Article 6(1)(f)).
• To introduce relevant services to incorporated businesses. Where professional contact details identify an individual, our lawful basis is our legitimate interest in developing relevant business relationships (Article 6(1)(f)), balanced against that person's rights and expectations. We limit outreach to business contact details and use the published business context to assess relevance. Public availability is not treated as consent.

You can object to direct marketing at any time using the opt-out link in our email, replying to it, or emailing info@digitalxp.co.uk. We stop the outreach sequence when we receive a reply and keep a minimal do-not-contact record when you opt out. Our AI assistant does not make decisions about individuals that produce legal or similarly significant effects.

We keep the list of third parties deliberately short. Each one below acts as a processor on our behalf:

• Web3Forms, receives your enquiry form submission and delivers it to us by email.
• Google Firebase, serves this website, holds the server logs described above, and stores our client records and any signed agreements. Data is held in the European Union.
• Our email provider, delivers signing links, one-time codes and signed copies of agreements. It processes the recipient address and the contents of those emails, including the signed PDF where one is attached.
• Google Workspace, processes our company email and calendar, including business correspondence and meeting details.
• OpenAI, processes the relevant text and source-code excerpts supplied to our internal AI assistant for requested business tasks. We disable optional Responses API storage and additional Agents SDK tracing; provider security and abuse-monitoring retention may still apply.

We never sell your personal data, and we do not share it with advertisers or data brokers. We may disclose information where we are legally required to.

Some of these providers operate outside the UK. Where personal data is transferred internationally, it is protected by UK adequacy regulations or by standard contractual clauses.

Our public website does not set analytics cookies or use browser storage to identify visitors. We count public page views, enquiry starts and delivery results in our own Firebase backend. The counters contain the day, a public page path, a broad source category and event totals. They contain no visitor ID, submitted text or full referrer URL. We do not use advertising pixels or session recordings. Browser event collection respects Do Not Track and Global Privacy Control signals.

While you browse, we keep the first public page and an inferred source category in memory. A full reload starts this again. If you choose the optional source-sharing checkbox when sending an enquiry, these details and the enquiry page are saved with your enquiry and sent through our email relay so we can understand which pages bring relevant work. Query strings and advertising click identifiers are not saved. Firebase may separately process request information, including IP addresses, for hosting, security and abuse prevention.

Linking source information to your enquiry is based on your consent. You can leave the optional checkbox unticked without affecting your enquiry, or withdraw that consent later by emailing info@digitalxp.co.uk. We use the aggregate counters to improve our website; they are not used to build advertising audiences.

The staff CRM uses Firebase authentication and browser storage to maintain signed-in sessions. Client support areas use short-lived access tokens to keep each client's tickets private.

One practical exception: while you fill in the quote form, your answers are kept as a draft in your browser's session storage on your own device, so a refresh doesn't wipe the form. That draft never leaves your browser until you press Submit, and it is discarded when you close the tab.

We keep quote enquiries and unsuccessful business prospect records for up to 24 months from our last contact with you, so we can pick up a conversation that goes quiet and come back to it. If you become a client, we keep project correspondence and records for 6 years after the engagement ends, to meet UK accounting and tax requirements. After those periods we delete the data or anonymise it. Server logs are retained on a short rolling window by our hosting provider.

You can ask us to delete your enquiry or prospect record sooner at any time; see below. We retain only the contact details needed to honour a marketing objection for as long as we operate the relevant outreach, so that deleting other records does not result in you being contacted again.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased, where we have no overriding reason to keep it.
• Restrict or object to how we process your data.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where we relied on consent.

To exercise any of these, email info@digitalxp.co.uk. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We'd appreciate the chance to put things right first.

This site is served over HTTPS, and form submissions are encrypted in transit. Access to enquiry data is limited to the people at Digital XP who need it to respond to you. No system is perfectly secure, but if a breach occurs that puts your rights at risk, we will notify you and the ICO as the law requires.

If we change how we handle personal data, we will update this page and revise the date at the top. Material changes affecting people who have already contacted us will be communicated by email.

Questions about this policy or your data are welcome at info@digitalxp.co.uk.